CVE-2023-45139

HIGH

fonttools 4.28.2-4.42.9 - XML External Entity Injection via SVG Table Parsing

Title source: llm

Description

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

References (6)

Core 6

Core References

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/VY63B4SGY4QOQGUXMECRGD6K3YT3GJ75/

Mailing List

http://www.openwall.com/lists/oss-security/2024/03/08/2

Mailing List

http://www.openwall.com/lists/oss-security/2024/03/09/1

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5

Patch x_refsource_misc

https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c

View Patch ZIP pw:eip

Release Notes x_refsource_misc

https://github.com/fonttools/fonttools/releases/tag/4.43.0

Scores

CVSS v3 7.5

EPSS 0.0123

EPSS Percentile 64.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-611

Status published

Products (2)

fonttools/fonttools 4.28.2 - 4.43.0

pypi/fonttools 4.28.2 - 4.43.0PyPI

Published Jan 10, 2024

Tracked Since Feb 18, 2026